PT-2025-13796 · Openemr · Openemr

Published 2025-03-31 · Updated 2025-04-30 · CVE-2025-30149

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 7.0.3

Description The issue concerns reflected cross-site scripting (XSS) in the AJAX Script interface, specifically in the layout listitems ajax.php file via the target parameter. This allows for potential XSS attacks.

Recommendations For versions prior to 7.0.3, update to version 7.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the layout listitems ajax.php file or avoiding the use of the target parameter in the AJAX Script interface until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-30149

GHSA-FWFV-8583-6RR7

Affected Products

Openemr

References · 9

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-fwfv-8583-6rr7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30149.json · Exploit
• https://github.com/openemr/openemr/commit/6cb70595f65decfbdd03e70b49acc414e03744b8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-30149 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30149 · Vendor Advisory
• https://t.me/cvedetector/21615 · Telegram Post
• https://t.me/cvetracker/20359 · Telegram Post
• https://twitter.com/dailycve/status/1917634362402554271 · Twitter Post
• https://twitter.com/CVEnew/status/1906752629335806198 · Twitter Post